Control-M - 29 CVEs (Page 1/1)

About “Control-M”

A curated feed of “Control-M”-related CVEs appears below. We currently track 29 CVEs for this tag (all time). In the last 365 days, 15 were published. Average CVSS is 7.4 (all time; 7.6 over 365d), and 66% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-121 - Stack-based Buffer Overflow, CWE-798 - Use of Hard-coded Credentials, CWE-284 - Improper Access Control.

In our taxonomy this topic maps to a LOW impact class. Developer and CI or CD tooling touches supply chains and secrets. Patch controllers and agents, enforce SSO or MFA, rotate tokens, isolate runners, and audit plugins. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.

Support & lifecycle: controlm

This table shows recent release cycles and their projected end-of-life. Data source: endoflife.date.

Cycle	Release	Latest	Premier Support	EOL
9.0.22	2025-05-19	9.0.22.050	2028-05-19	2030-05-19
9.0.21	2022-09-08	9.0.21.300	2026-09-30	2027-09-08
9.0.20	2020-07-24	9.0.20.200	2024-04-30	2025-07-23 Expired
9.0.19	2019-03-04	9.0.19.200	2022-12-31	2024-03-04 Expired
9.0.18	2018-01-03	9.0.18.200	2021-03-31	2023-03-31 Expired
9.0.0	2015-07-15	9.0.00.200	2018-08-01	2020-10-31 Expired

Maintained Soon (≤ 180 days) Expired

Subscribe lifecycle: RSS · RSS (expired) · ICS

Subscribe CVEs: RSS for “Control-M” · RSS (High+Critical only)

CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).

CVSS ≥ 0.0

2026-04-10

Critical

CVE-2026-23781

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A set of default debug user credentials is hardcoded in cleartext within the application package. If left unchanged, these credenti…

CVSS: 9.8 CWE: CWE-798 - Use of Hard-coded Credentials View on NVD

High

CVE-2026-23782

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. An API management endpoint allows unauthenticated users to obtain both an API identifier and its corresponding secret value. With t…

CVSS: 7.5 CWE: CWE-284 - Improper Access Control View on NVD

High

CVE-2026-23780

An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated attacker to inject malicious queries due to…

CVSS: 8.8 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

2025-11-05

Critical

CVE-2025-55108

The Control-M/Agent is vulnerable to unauthenticated remote code execution, arbitrary file read and write and similar unauthorized actions when mutual SSL/TLS authentication is not enabled (i.e. in t…

CVSS: 10.0 CWE: CWE-306 - Missing Authentication for Critical Function View on NVD

2025-09-16

High

CVE-2025-55118

Memory corruptions can be remotely triggered in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases: * Control-M/Agent 9.0.20: SSL/TLS configur…

CVSS: 8.9 CWE: CWE-122 - Heap-based Buffer Overflow View on NVD

Medium

CVE-2025-55117

A stack-based buffer overflow can be remotely triggered when formatting an error message in the Control-M/Agent when SSL/TLS communication is configured. The issue occurs in the following cases:…

CVSS: 5.3 CWE: CWE-121 - Stack-based Buffer Overflow View on NVD

High

CVE-2025-55116

A buffer overflow in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M…

CVSS: 8.8 CWE: CWE-121 - Stack-based Buffer Overflow View on NVD

High

CVE-2025-55115

A path traversal in the Control-M/Agent can lead to a local privilege escalation when an attacker has access to the system running the Agent. This vulnerability impacts the out-of-support Control-M/A…

CVSS: 8.8 CWE: CWE-23 - Relative Path Traversal View on NVD

Medium

CVE-2025-55114

The improper order of AUTHORIZED_CTM_IP validation in the Control-M/Agent, where the Control-M/Server IP address is validated only after the SSL/TLS handshake is completed, exposes the Control-M/Agen…

CVSS: 5.3 CWE: CWE-696 - Incorrect Behavior Order View on NVD

Critical

CVE-2025-55113

If the Access Control List is enforced by the Control-M/Agent and the C router is in use (default in Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versi…

CVSS: 9.0 CWE: CWE-158 - Improper Neutralization of Null Byte or NUL Character View on NVD

High

CVE-2025-55112

Out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 (and potentially earlier unsupported versions) that are configured to use the non-default Blowfish cryptography algorithm use a hardcoded key.…

CVSS: 7.4 CWE: CWE-321 - Use of Hard-coded Cryptographic Key View on NVD

Medium

CVE-2025-55111

Certain files with overly permissive permissions were identified in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions as well as in newer versi…

CVSS: 5.5 CWE: CWE-276 - Incorrect Default Permissions View on NVD

Medium

CVE-2025-55110

Control-M/Agents use a kdb or PKCS#12 keystore by default, and the default keystore password is well known and documented. An attacker with read access to the keystore could access sensitive data us…

CVSS: 5.5 CWE: CWE-1392 - Use of Default Credentials View on NVD

Critical

CVE-2025-55109

An authentication bypass vulnerability exists in the out-of-support Control-M/Agent versions 9.0.18 to 9.0.20 and potentially earlier unsupported versions when using an empty or default kdb keystore…

CVSS: 9.0 CWE: CWE-295 - Improper Certificate Validation View on NVD

2025-08-07

Low

CVE-2025-48709

BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe these credentials and use them to log in t…

CVSS: 3.8 CWE: CWE-214 - Invocation of Process Using Visible Sensitive Information View on NVD

2024-03-18

Medium

CVE-2024-1606

Lack of input sanitization in BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users for manipulation of generated web pages via injection of HTML code. This might lead to a successful ph…

CVSS: 4.6 CWE: CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) View on NVD

Medium

CVE-2024-1605

BMC Control-M branches 9.0.20 and 9.0.21 upon user login load all Dynamic Link Libraries (DLL) from a directory that grants Write and Read permissions to all users. Leveraging it leads to loading o…

CVSS: 6.6 CWE: CWE-276 - Incorrect Default Permissions View on NVD

Medium

CVE-2024-1604

Improper authorization in the report management and creation module of BMC Control-M branches 9.0.20 and 9.0.21 allows logged-in users to read and make unauthorized changes to any reports available w…

CVSS: 6.4 CWE: CWE-639 - Authorization Bypass Through User-Controlled Key View on NVD

2023-07-31

Critical

CVE-2023-39122

BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. This is fixed in 9.0.21 (and is also fixed by a patch for 9.0.20.200).

CVSS: 9.8 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

2023-02-25

Critical

CVE-2023-26550

A SQL injection vulnerability in BMC Control-M before 9.0.20.214 allows attackers to execute arbitrary SQL commands via the memname JSON field.

CVSS: 9.8 CWE: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') View on NVD

2020-04-30

High

CVE-2019-19220

BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2).

CVSS: 8.8 CWE: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') View on NVD

High

CVE-2019-19219

BMC Control-M/Agent 7.0.00.000 allows Arbitrary File Download.

CVSS: 7.5 CWE: N/A View on NVD

High

CVE-2019-19218

BMC Control-M/Agent 7.0.00.000 has Insecure Password Storage.

CVSS: 7.5 CWE: CWE-522 - Insufficiently Protected Credentials View on NVD

High

CVE-2019-19217

BMC Control-M/Agent 7.0.00.000 allows OS Command Injection.

CVSS: 8.8 CWE: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') View on NVD

High

CVE-2019-19216

BMC Control-M/Agent 7.0.00.000 has an Insecure File Copy.

CVSS: 8.8 CWE: CWE-269 - Improper Privilege Management View on NVD

High

CVE-2019-19215

A buffer overflow vulnerability in BMC Control-M/Agent 7.0.00.000 when the On-Do action destination is Mail and the Control-M/Agent is configured to send the email, allows remote attackers to have un…

CVSS: 8.8 CWE: CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') View on NVD

2017-05-16

High

CVE-2016-10238

In QSEE in all Android releases from CAF using the Linux kernel access control may potentially be bypassed due to a page alignment issue.

CVSS: 7.8 CWE: CWE-264 View on NVD

2005-10-26

Low

CVE-2005-3311

BMC Software Control-M 6.1.03 for Solaris, and possibly other platforms, allows local users to overwrite arbitrary files via a symlink attack on temporary files.

CVSS: 2.1 CWE: N/A View on NVD

2000-12-11

Medium

CVE-2000-1060

The default configuration of XFCE 3.5.1 bypasses the Xauthority access control mechanism with an "xhost + localhost" command in the xinitrc program, which allows local users to sniff X Windows traffi…

CVSS: 4.6 CWE: N/A View on NVD